GitHub REA is the open-source project morluto/rea, short for Reverse Engineer Anything. It is an MCP server and command-line tool that lets an AI agent inspect native binaries, JavaScript and Electron apps, .NET assemblies and websites, then return findings together with the evidence behind them. GitHub REA is MIT licensed and its homepage is rea.tools.

How do I install GitHub REA?

With Node.js and npm installed, run npx rea-agents setup. The GitHub REA setup tool lets you pick your agents, shows the changes it plans to make, and adds the REA MCP server plus matching workflow instructions after you approve. Restart your agent afterwards. For regular terminal use, npm install --global rea-agents installs the rea command.

The GitHub REA code is free and open source under the MIT licence. Some analysis needs other tools, though. Native binary work uses Hopper, Ghidra or IDA, and commercial tools such as IDA Pro, Hopper and JEB must be legally licensed by you. REA grants no tool licence, key or activation.

Which agents work with GitHub REA?

Any agent that supports local MCP servers can use GitHub REA. The setup command covers Claude Code, Codex, Cursor, Gemini CLI and Grok Build, and other clients can register the GitHub REA MCP server by hand using the installation guide in the repository.

Does GitHub REA upload my app to the cloud?

According to the project, GitHub REA analysis runs locally on your machine. Your agent receives the tool results, and the company behind your agent's model has its own data policy, so read it before you point an agent at private software.

Is GitHub REA safe and legal to use?

The project says REA is for lawful research, education, interoperability, software preservation and analysis of software you own or are authorized to examine. Cracked tools, stolen keys and bypassing licence restrictions are not authorized. To use GitHub REA lawfully, only analyze software you have the right to inspect, and follow local law and the target's licence terms.

Where is the official GitHub REA download?

For a genuine GitHub REA download, use github.com/morluto/rea, the rea.tools website, or the rea-agents package on npm. The README warns that a similar repository name or a copied README does not prove a download is official, so follow install links only from those sources.

GitHub REA: What morluto/rea Is, How to Set It Up & What It Can Do

Published October 15, 2026

GitHub REA is the search phrase for morluto/rea, an open-source project whose name stands for Reverse Engineer Anything. It gives an AI agent a set of tools to look inside software and explain how a feature works, with the evidence attached. This guide covers what GitHub REA is, how to install it, what it can analyze, where it stops, and the lawful-use rules that come with it. Facts here come from the project’s public README at the time of writing.

What Is GitHub REA?

GitHub REA is an MCP server plus a command-line tool. MCP, the Model Context Protocol, is the standard way for an agent to call local tools. When you connect GitHub REA to your agent, the agent can inspect a program you point it at, trace the code that matters, and answer follow-up questions. The README describes the flow in one line: you see a feature you like, and you ask your agent to understand how it works, down to the binary level.

GitHub REA is written mostly in TypeScript, uses the MIT licence, and publishes the rea-agents package on npm. GitHub REA also has a website at rea.tools with guides and case studies. Treat those, together with the repository, as the official sources.

How to Install GitHub REA

Installing GitHub REA takes one command if Node.js and npm are present. The README asks for Node.js 22.19 or newer on the 22 line, 24.11 or newer on the 24 line, or any 26+ release.

Run npx rea-agents setup in a terminal.
Choose which agents to configure, and read the proposed changes. Setup keeps backups of your existing configuration.
Approve the changes, then restart your agent.
Ask a question, such as how search works in an app you own, and ask the agent to show the evidence.

For regular terminal use, run npm install --global rea-agents and then rea --help. When a new release arrives, rea update refreshes GitHub REA, and you rerun the setup command to refresh your agent registrations. If you prefer Bun, bunx rea-agents@latest replaces the npx form.

What GitHub REA Can Analyze

GitHub REA covers many target types. The README lists more, but the main groups are:

Target	What GitHub REA returns	What you may need
Native binaries	Pseudocode, assembly, strings, symbols, calls	Hopper, Ghidra or IDA
JavaScript and Electron apps	Modules, imports, source maps, routes, IPC	Node.js and npm
Websites	Page structure, scripts, network observations	A Chrome-family browser
.NET assemblies	Metadata and CIL instructions	Nothing extra, static only
Android APKs	Manifest, classes, decompiled methods	Headless JADX and a JDK
Saved network captures	Requests, responses, source locations	A HAR or SAZ file

Static JavaScript and .NET inspection read the files you supply without running the application. Runtime capture does run the target with your user permissions, so read the guide for each mode first. A quick terminal example from the README inspects an extracted Electron app with npx -y rea-agents@latest analyze-javascript-application /path/to/app --json.

GitHub REA Limits and Setup Tips

GitHub REA is a tool, not a magic button. Deep native analysis needs one of Hopper, Ghidra or IDA, and the first run of Hopper on macOS may show a licence dialog you must complete yourself. Large binaries can need a longer startup deadline, which the README controls with environment variables for Ghidra and Hopper. On Linux some modes need a procps-compatible ps. GitHub REA results come with limitations and unknowns, so treat the agent’s explanation as a lead to check, not as proof.

GitHub REA moves fast, so keep it updated. If you hit a bug, update first, retry, and then open an issue on GitHub with your version, target type, steps and error output.

Lawful Use of GitHub REA

GitHub REA is built for lawful research, education, interoperability, software preservation, and analysis of software you own or are authorized to examine. This guide does not cover cracking, licence bypass or exploiting systems, and neither does GitHub REA. If you use commercial tools such as IDA Pro, Hopper or JEB, you must hold a legal licence. Read the repository’s disclaimer before you start, and leave a target alone if you are not sure you may inspect it.

What to Do After You Set Up GitHub REA

Start small. Pick a program you wrote or an open-source app, ask your agent one narrow question, and read the evidence it returns. The README showcases show the pattern: following a sound call into a helper function, or tracing a clipboard feature through an Electron app’s preload and main process. Once the agent explains a feature, you can ask it to write a similar one for your own project and then test it. That is the everyday way to use GitHub REA: one narrow question, one evidence-backed answer.

If you also need pictures for a write-up or a demo, such as a diagram or cover image for your notes on GitHub REA, RiceBowl’s GPT Image 2 page makes an image from a prompt in your browser, and the explore page shows other AI tools. RiceBowl is not affiliated with morluto or the GitHub REA project.